Is This Forged And Spoofy Email? [closed]

Question

The email from Agent@Adobe.com claims to be from Adobe. After analyzing its source i have not found anything suspicious, only ivest8 and this IP: 98.143.35.69.

While invest8 shows a lot in Google, i have analyzed IP:

When i followed link, i have arrived to a page trying me to peddle something so it was obvious email was not real.

It also is weird that after i saved email as .HTML file and executed it, i was brought to site without being able to view email. Looks like a tricky redirect in source code to me...

If anybody here knows how to find forged and spoofy emails, can you enlighten me please? Here is the link to download .EML file.

Thanks.

Answer 1

• The sender address does not belong to Adobe. According to WHOIS, it is owned by "CWIE, LLC".

  Received: from invest8 ([98.143.35.69]) by mxin7.netvision.net.il
  

• Spelling and grammar errors in the subject. PDF mistyped as "Pdf".

  Subject: Convert Any File to Pdf and FREE OFFICE SUIT INCLUDED !
  

• Adobe is very unlikely to use Microsoft Outlook Express for anything, and especially not for batch emails.

  X-Mailer: Microsoft Outlook Express 6.00.2800.1106
  

• "Microsoft MimeOLE" is a quite reliable sign of spam messages.

  X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
  

• The links in the message body point to toptraces.com, which hosts a public URL shortener service.

• The website http://pdf-pro-online.com/, pointed to by http://toptraces.com/pdf2012, is not affiliated with Adobe, as it says in the footer:

  This website has no affiliation whatsoever with the owner of the software program Adobe and does not re-sell or license the Adobe software. This website offers an alternative to the Adobe PDF Reader/Wrtier software. Membership is for unlimited access to our site's resources. We also provide technical support, tutorials and step by step guides.

  The website is owned and operated by Certo Business Solutions B.V

Conclusion: Spam.